Homepage
About Snyk

Improper Handling of Exceptional Conditions Affecting github.com/authzed/spicedb/internal/datasets package, versions <1.30.1

0.0
low

Snyk CVSS

    Attack Complexity High
    Privileges Required High

    Threat Intelligence

    EPSS 0.05% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-GOLANG-GITHUBCOMAUTHZEDSPICEDBINTERNALDATASETS-6595952
  • published 11 Apr 2024
  • disclosed 10 Apr 2024
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 10 Apr 2024

New CVE-2024-32001 Open this link in a new tab
CWE-755 Open this link in a new tab

How to fix?

Upgrade github.com/authzed/spicedb/internal/datasets to version 1.30.1 or higher.

Overview

Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions due to the use of a specific relation form and an arrow over the relation, only partial results are returned under certain conditions. This issue arises when the same subject type is utilized multiple times in a relation, relationships exist for both subject types, and an arrow is used over the relation. This can lead to incomplete authorization decisions based on the results of a LookupSubjects request.

Note

This is only exploitable if the same subject type is used multiple times in a relation, relationships exist for both subject types, and an arrow is used over the relation.

Workaround

This vulnerability can be mitigated by avoiding the use of LookupSubjects for negative authorization decisions and/or avoiding the use of the broken schema.